What’s Vulnerable › Vulnerabilities

CVE-2021-21418: Potential XSS injection in the newsletter conditions field

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-31 · updated 2026-06-17
• Weakness: CWE-79

Description

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1

Affected products

• PrestaShop ps_emailsubscription: from 2.6.0 before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: PrestaShop ps_emailsubscription 2.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
• https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
• https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
• https://packagist.org/packages/prestashop/ps_emailsubscription
• https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
• https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
• https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
• https://packagist.org/packages/prestashop/ps_emailsubscription

Get alerted when CVE-2021-21418 or the next vulnerability affects your stack